CVE-2026-86533
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working. This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
ash_authentication
- Vendor
- team-alembic
- Product
- ash_authentication
- Platforms
- Unknown
- Default status
unaffected- Package
- ash_authentication
- Package collection
- https://repo.hex.pm
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.9.1 | affected | semver | 4.15.0 | Unavailable | None listed |
| 5.0.0-rc.0 | affected | semver | 5.0.0-rc.14 | Unavailable | None listed |
ash_authentication
- Vendor
- team-alembic
- Product
- ash_authentication
- Platforms
- Unknown
- Default status
unaffected- Package
- team-alembic/ash_authentication
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| fcaeb73f76f8f2e9aef8bf637690d2a20dd97596 | affected | git | * | Unavailable |
|
ash_authentication_phoenix
- Vendor
- team-alembic
- Product
- ash_authentication_phoenix
- Platforms
- Unknown
- Default status
unaffected- Package
- ash_authentication_phoenix
- Package collection
- https://repo.hex.pm
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.10.0 | affected | semver | 2.17.4 | Unavailable | None listed |
| 3.0.0-rc.0 | affected | semver | 3.0.0-rc.11 | Unavailable | None listed |
ash_authentication_phoenix
- Vendor
- team-alembic
- Product
- ash_authentication_phoenix
- Platforms
- Unknown
- Default status
unaffected- Package
- team-alembic/ash_authentication_phoenix
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 | affected | git | * | Unavailable |
|
| 0135217e34e621dac79ae3d9559aeee49304b0aa | affected | git | * | Unavailable |
|